Powerlevel10k before 1.20.19 Symlink Following via Instant Prompt Temporary File

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

Powerlevel10k before 1.20.19 contains a symlink following vulnerability in _p9k_dump_instant_prompt that allows local attackers to overwrite victim-writable files via a predictable temporary path. Attackers can pre-plant symlinks at p10k-instant-prompt-output-<user>-<pid> in TMPDIR, guessing the victim's shell PID, so shell startup truncates and overwrites targeted files.

Etkilenen sürümler1 yazılım

Kaynaklar7 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…ommit/7ddd1b2715c3844275214347a3572ac1fdd6dc39 Yama
• github.com/romkatv/powerlevel10k/issues/2972 Üçüncü taraf
• vulncheck.com/…nk-following-via-instant-prompt-temporary-file Üçüncü taraf
• github.com/romkatv/powerlevel10k Diğer
• github.com/…v/powerlevel10k/blob/v1.20.0/internal/p10k.zsh Diğer

Kayıt geçmişi

1. 4 Kas 2026 23:36Yayımlandı

İlgili açıklar

• 6,7 CVE-2026-122137Powerlevel10k before 1.20.19 Insecure Temporary Directory via gitstatus Installer
• 5,5 CVE-2026-121746nvm use --save and nvm install --save write through a symlinked .nvmrc, overwriting any file the user can write
• 5,5 CVE-2026-121747nvm prints the contents of any readable file through a symlinked .nvmrc
• 4,7 CVE-2026-122235Jan 0.8.5 before 0.8.8 Workspace Guard Bypass via Dangling Symlink
• 4,4 CVE-2026-64672Terragrunt catalog predictable temp symlink clobber
• 8,1 CVE-2026-121224Security issue in Desktop in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had comprom…